Salting doesn't matter in this case. They're not finding a list of free-floating passwords and then seeing if anyone has that password; they're finding a list o

Salting doesn't matter in this case. They're not finding a list of free-floating passwords and then seeing if anyone has that password; they're finding a list of accounts and associated passwords. So they only have to check that particular combination, just as they would for a regular login.